Get SOC 2 done, with an agent.

Vanta and Drata are dashboards a human compliance person works inside. Screenata is the compliance person. Vera scans your infrastructure, writes policies from what's real, collects evidence, runs scheduled checks at 6 AM, and delivers everything through Slack, email, GitHub, and your terminal. The dashboard exists for auditors and deep dives — the daily work happens where you already are.

Yes. Daily 6:00 AM evidence freshness checks, daily 6:15 AM readiness snapshots, weekly Monday cloud and code scans, quarterly access reviews, and annual risk refreshes all run on scheduled jobs. Vera flags stale evidence, drafts delegation messages, scopes remediation, and posts agent reports. You approve actions; you don't run them.

Screenata scans first, then writes. We pull context from GitHub, AWS or GCP, your IdP, existing evidence, and your company profile, then generate policies grounded in what we found. The overpromise checker flags hard commitments (like 'quarterly access reviews') we cannot verify in evidence, before you ever ship them to an auditor.

Yes. Each claim in a policy is anchored to a specific sentence and linked to the control test that verifies it. Each test has its evidence submissions, and each submission references a cryptographically signed artifact. An auditor can hover any claim in a policy, see the test that proves it, and verify the evidence package independently with a signed manifest.

Evidence exports are tamper-evident: SHA-256 per-file hashes, RSA or ECDSA digital signatures, RFC 3161 independent timestamps, and BYOK support so enterprises can sign with their own keys. We're publishing the format as an open spec with a free verify CLI so anyone can check a Screenata pack without an account.

Yes — Slack is a first-class surface, not a notification channel. Vera posts daily readiness briefings in your #compliance channel at 6:30 AM, DMs teammates for evidence with step-by-step instructions, and accepts file drops directly in Slack — auto-classifying, signing, and routing them to the right control. Slash commands and approval blocks are built in. The dashboard exists for auditors and deep dives; daily compliance work happens where your team already talks.

Yes. Every artifact is mapped to specific Trust Services Criteria or HIPAA safeguards, signed with SHA-256 + RFC 3161 timestamps, and traceable from policy claim → control test → submission → vault artifact. Auditors get a structured pack — not a folder of screenshots — and can verify integrity independently with a free CLI. We design the output for what auditors actually look for in fieldwork: completeness, attribution, freshness, and tamper evidence.

SOC 2 and HIPAA today, with more on the way. Our control model uses a shared canonical catalog so a single MFA scan satisfies SOC 2 CC6.1 and HIPAA §164.312(d) at the same time — and the same scan will map to ISO 27001 and other frameworks as we add them. You collect evidence once instead of paying for each framework separately.